Added ability for cert manager to reject keys and rollback to early versions.
Wasn't setting leaves update time on initial load, so needed to wait the leaves commit time delay before it would get updated.  Since that's on the order of 12 hours and we get rolled potentially every 24 hours, this wasn't going to work.  Fixed.